Bah. So the impossible happened. https://www.milter.org/developers/overview#ControlFlow is pretty clear that xxfi_connect is called before xxfi_helo. If mlfi_connect's call to smfi_setpriv fails, it returns an error code that should drop the connection, so there shouldn't ever be a way for mlfi_helo to be called with a null sctx variable. If you check your sendmail log, do you see any errors saying "smfi_setpriv failed"?